cis-aws-compute-10-1

name	cis-aws-compute-10.1
description	Ensure Managed Platform updates is configured
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","elastic-beanstalk","managed-updates","patching","platform"]
cis_id	10.1
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-10.2","cis-aws-compute-10.3","cis-aws-compute-10.4"]
prerequisites	[]
severity_boost	{}

10.1 Ensure Managed Platform updates is configured (Manual)

Description

AWS Elastic Beanstalk regularly releases platform updates to provide fixes, software updates, and new features. With managed platform updates, you can configure your environment to automatically upgrade to the latest version of a platform during a scheduled maintenance window.

Rationale

Your application remains in service during the update process with no reduction in capacity. Managed updates are available on both single-instance and load-balanced environments. They also ensure you aren't introducing any vulnerabilities by running legacy systems that require updates and patches.

Impact

N/A

Audit Procedure

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
2. On the left hand side click Environments
3. Click on the Environment name that you want to review
4. Under the environment_name-env in the left column click Configuration
5. Scroll down under Configurations
6. Under category look for Managed updates
7. Confirm Managed updates: enabled
8. If status options reads Managed updates: disabled refer to the remediation below.
9. Repeat steps 3-8 for each environment within the current region.
10. Then repeat the Audit process for all other regions.

Using AWS CLI

N/A - This control is manual and console-based.

Expected Result

Managed updates: enabled is displayed under the Managed updates category in the environment Configuration.

Remediation

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
2. On the left hand side click Environments
3. Click on the Environment name that you want to update
4. Under the environment_name-env in the left column click Configuration
5. Scroll down under Configurations
6. Under category look for Managed updates
7. Click on Edit
8. On the Managed Platform Updates page:

Managed updates - click the Enable checkbox
Weekly update window - set preferred maintenance window
Update level- set it to Minor and patch
Instance replacement - click the Enabled checkbox